Skip to content
Critical CitrixBleed-2 Vulnerability (CVE-2025-5777)

Critical CitrixBleed-2 Vulnerability (CVE-2025-5777)

First seen 24 Oct 2026, 20:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 24, 2026 at 22:13 UTC
  • •CVE-2025-5777 allows unauthenticated attackers to leak sensitive data from memory.
  • •The vulnerability affects multiple versions of Citrix NetScaler ADC and Gateway products.
  • •Exploitation in the wild has been confirmed, with critical patches released by Citrix.

CVE-2025-5777, known as CitrixBleed-2, is a critical unauthenticated out-of-bounds read vulnerability in Citrix NetScaler ADC and Gateway products. Disclosed on June 17, 2025, it allows attackers to leak sensitive memory data, including session tokens, via a single crafted HTTP request. Affected versions include NetScaler ADC and Gateway 14.1-43.56 and later, as well as 13.1-58.32 and later. The vulnerability has a CVSS score of 9.3, indicating its critical nature. Following its disclosure, exploitation was observed in the wild, prompting Citrix to release patches shortly thereafter. Tools for detecting and exploiting this vulnerability have emerged, emphasizing its ongoing threat. As of now, no official mitigations exist for unpatched systems, and security professionals are urged to apply available patches immediately.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2023-10-10
CVE-2023-4966 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2025-06-17
CVE-2025-5777 disclosed
Citrix announced the critical out-of-bounds read vulnerability affecting NetScaler products.
Sploitus
2025-06-23
Patches released
Citrix released patches for affected versions of NetScaler ADC and Gateway to mitigate the vulnerability.
Sploitus
2025-07-10
CISA KEV addition
CISA added CVE-2025-5777 to its Known Exploited Vulnerabilities catalog due to active exploitation.
Sploitus

More articles in this cluster (3)

Following this threat?

Track CVE-2023-4966 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (20)

1 / 4

Common questions

What versions of Citrix are affected?
Affected versions include NetScaler ADC and Gateway 14.1-43.56 and later, 13.1-58.32 and later, and specific FIPS versions.
Is CVE-2025-5777 actively exploited?
Yes, active exploitation has been confirmed, leading to its addition to the CISA KEV catalog.
What should organizations do to protect themselves?
Organizations should immediately apply the available patches to their Citrix NetScaler products to mitigate the vulnerability.